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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )E3 Responsive to communication(s) filed on 05 May 2006 . 
2a)D This action is FINAL. 2b)K This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [>3 Claim(s) 1-10,13-20.23 and 24 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) [J Claim(s) is/are allowed. 

6) E3 C!aim(s) 1-10,13-20,23 and 24 is/are rejected. 

7) Q Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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Response to Arguments 

Applicant's arguments with respect to claims 1-10, 13-20 and 23-24 have been considered 
but are moot in view of the new ground(s) of rejection. 

Terminal Disclaimer 
The terminal disclaimer filed on 10/24/05 has been recorded. 
Claim Rejections - 35 USC $ 112 
The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

Claims 23-24 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

The applicant failed to clearly and distinctly claims the subject matter as set forth in 
claims 23-24. Claims 23-24 fails to disclose the subject matter, which applicant regards as his 
invention. 

It is unclear as to what applicant intends to cover in claims 23-24. 

Claim Rejections - 35 USC S 101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 23-24 are rejected under 35 U.S.C. 101 because the claimed invention lacks 
patentable utility. 
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The claims fail to disclose a practical application that would have produced useful, 
concrete and tangible results. 

Claims 23-24 simply fails to produce useful, concrete and tangible results. 

For more information on 35 USC 101, please refer to the 101 guidelines available on 
USPTO website. 

Claim Rejections - 35 USC $ 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

1 . Claims 23-24 are rejected under 35 U.S.C. 102(e) as being anticipated by Wong et al. 
(hereinafter Wong, U. S. Patent No. 6,389,419 Bl). 

As per claim 23, Wong discloses in a device operatively coupled to a network, a 
computer-readable data signal having a body portion for use in identifying an ingress location of 
a target packet in said network (fig. 6), said body portion comprising: 

- a hash value identifying said target packet as detected by said device, said hash value of 
said target packet having been computed by said device (fig. 6 item #602, 608 and 610 
and fig. 7); and 

- identification information about said device (fig. 3c). 

As per claim 24, Wong discloses the process comprising a data packet including header 
portion, said header portion comprising: a network address (fig. 3c). 
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Claim Rejections - 35 USC S 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103(c) 
and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a). 
2. Claims 1-5, 7, 9, 10, 13-15, 17, 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Conklin et al. (hereinafter Conklin, U. S. Patent No. 5,991,881) in view of 
Wong et al. (hereinafter Wong, U. S. Patent No. 6,389,419 Bl). 

As per claim 1 , Conklin discloses in a network carrying a plurality of packets over at 
least one network link, said network including a computer, a first network component having 
memory and a processor and configured to store information in said memory about at least one 
of said plurality of packets, and a second network component (fig. 16), a method for detecting 
target packet comprising (col. 1 LI 0-65): receiving said at least one of said plurality of packets 
over a link to obtain a received packet (fig. 7, fig. 8, col. 3 L60-65); receiving a query message 
identifying a target packet at said first component (fig. 7, fig. 8, col. 3 LI -14); creating a reply if 
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said target packet has been encountered (col. 4 L9-60, col. 5 L10-60, fig. 6, fig. 9); and said first 

0 

network component making said reply available to said network if said target packet has been 
encountered, wherein reply is capable of being used as part of a method for locating said 
intrusion point for said first one of the packets (fig. 9), 

However, Conklin does not disclose the process of determining a hash value of at least a 
portion of said packet; using said has value to identify a location in a memory; setting a flag in 
said memory, said flag associated with said location; and said first network component using a 
flag in processing said query message to determine if said target packet has been encountered 
(note that Conklin teaches the process of detecting an intrusion by pattern matching or 
comparing, see col. 7 L50-65, fig. 7). 

Wong, from the same field of endeavor explicitly discloses the process of determining a 
hash value of at least a portion of said packet (fig. 2B item #222, fig. 2C item #242 and fig. 3C, 
fig. 6 item #602, col. 6 L4-8); using said hash value to identify a location in a memory (fig. 2B 
item #224, fig. 2C item #244, fig. 6 item #604); setting a flag in said memory, said flag 
associated with said location (fig. 6 item #608, fig. 8 item #818820, 822, col. 6 L4-15, col. 7 
L28-36, col. 9 L6-33); and said first network component using a flag in processing said query 
message (a message or a packet) to determine if said target packet has been encountered (fig. 8 
item #818, 820, 822 and fig. 6 item #608, 610, col. 5 L59-63, col. 6 L4-36). 

Therefore it would have been obvious to a person of ordinary skilled in the art at the time 
the invention was made to modify Conklin in view of Wong in order to use the hashing 
technique to determine or identify the packet. 
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One of ordinary skilled in the art would have been motivated because it would have 
located and/or identified the packet (whether target, incoming or outgoing) in a more efficient 
manner, which would have reduced the latency in the network appliance (Wong, col. 2 LI 9-41, 
col. 3L27-30, L45-51). 

As per claim 2, Conklin discloses the process wherein making said reply available to said 
network includes forwarding said reply to said second network component (fig. 9, col. 5 L10- 
60). 

As per claim 3, Conklin discloses the process wherein said second network component is 
a computer (fig. 9, col. 5 LI 0-60). 

As per claim 4, Conklin discloses the process wherein said reply contains a network 
address for said first network component (col. 6 L9-15). 

As per claim 5, Conklin does not disclose the process wherein hash value is determined 
over the entire packet. 

Wong, from the same field of endeavor discloses the process wherein the addresses in a 
packet are hashed (col. 5 L60 to col. 6 L35, fig. 2, fig. 5 and fig. 7-8). 

Therefore it would have been obvious to a person of ordinary skilled in the art at the time 
the invention was made to modify Conklin in view of Wong in order to determine the hash value 
over the entire packet. 

One of ordinary skilled in the art would have been motivated because of the same reasons 
as set forth in claim 1 . 

As per claim 7, Conklin discloses the process wherein said network is an Internet 
Protocol (IP) network (fig. 1) 
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As per claim 9, Conklin discloses the process wherein said first network component is a 
router (fig. 1-3). 

As per claim 14, Conklin discloses the system wherein said first interface and second 
interface are combined into a single bi-directional interface (fig. 4). 

As per claim 15, Conklin discloses the process wherein said reply is made available to 
another network (fig. 9). 

As per claim 19, the combination of Conklin and Wong discloses the system wherein said 
reply is positive reply if said second has value matches at least one of said plurality of first hash 
values. 

As per claim 20, Conklin discloses the system wherein said reply is forwarded to those of 
said devices one hop away (fig. 9 and fig. 3). 

As per claims 10, 13 and 17, they do not teach or further define over the limitations in 
claims 1-5, 7, 9, 14-15, 19 and 20. Therefore claims 10, 13 and 17 are rejected for the same 
reasons as set forth in claims 1-5, 7, 9, 14-15, 19 and 20. 
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3. Claims 8, 16 and 18 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Conklin et al. (hereinafter Conklin, U. S. Patent No. 5,991,881) in view of Wong et al. 
(hereinafter Wong, U. S. Patent No. 6,389,419 Bl), and further in view of "Official Notice". 

As per claim 8, Conklin in view of Wong does not explicitly disclose the process wherein 
the link is a wireless link or network. 

But, wireless networks and/or links are well known in the relevant art. 

Official Notice is taken in order to indicate that the subject matter is in fact well known 
and obvious in the art. 

Therefore, it would have been obvious to a person of ordinary skilled in the art at the time 
the invention was made to modify Conklin in view of Wong in order to implement the invention 
in wireless networks. 

One of ordinary skilled in the art would have been motivated because wireless networks 
are very well known in the art. 

As per claim 18, Conklin in view of Wong does not explicitly disclose a system wherein 
the processor is an ASIC processor. 

But, ASIC processors are simply well known and obvious in the relevant art. 

Official Notice is taken to indicate that the ASIC processors are known and obvious in 

the art. 

Therefore, it would have been obvious to a person of ordinary skilled in the art at the time 
the invention was made to modify Conklin in view of Wong in order to include ASIC processors. 

One of ordinary skilled in the art would have been motivated because ASIC processors 
are simply known in the art. 
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As per claim 16, it does not teach or further define over the limitations in claim 8 and 18. 
Therefore claim 16 is rejected for the same reasons as set forth in claim 8 and 18. 

4. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Conklin et al. 
(hereinafter Conklin, U. S. Patent No. 5,991,881) in view of Wong et al. (hereinafter Wong, U. 

5. Patent No. 6,389,419 Bl), and further Cox et al. (hereinafter Cox, U. S. Patent No. 6,842,861). 

As per claim 6, Conklin in view of Wong does not teach the process of determining if 
said received packet has undergone a transformation, such transformation having occurred if a 
first hash value of at least a portion of said packet computed at a first time is not equal to a 
second hash value of at least a portion of said packet computed at a second time, said second 
time occurring after said first time. 

Cox teaches determining if said received packet has undergone a transformation, such 
transformation having occurred if a first hash value of at least a portion of said packet computed 
at a first time is not equal to a second hash value of at least a portion of said packet computed at 
a second time, said second time occurring after said first time (col.2, L 34-41). 

Therefore it would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teaching of Wong to add determining if said received packet has 
undergone a transformation, such transformation having occurred if a first hash value of at least a 
portion of said packet computed at a first time is not equal to a second hash value of at least a 
portion of said packet computed at a second time, said second time occurring after said first time 
as taught by Cox in order to determine infected files (Cox, col. 2, line 34). 
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One ordinary skilled in the art at the time of the invention would have been motivated to 
combine Cox and Wong in order to provide a system to detect a file with a virus (Cox. col.l, 
lines 5-67). 

Additional References 
The prior art made of record and not relied upon is considered pertinent to applicants 
disclosure. 

a. Sheymov, U. S. Patent No. 6,98 1 , 1 46 B 1 : Network Intrusion Protection. 

b. Vaidya, U. S. Patent No. 6,279,1 13 Bl: Network Intrusion Detection. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to KAMAL B. DIVECHA whose telephone number is 571-272- 
5863. The examiner can normally be reached on Increased Flex Work Schedule. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung can be reached on 571-272-3939. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Kamal Divecha 
Art Unit 2151 
July 7, 2006. 
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SUPERVISORY PATEN 



